capa-rules
capa-rules copied to clipboard
reconsider att&ck classification for get/set-uefi-variable.yml
We should reconsider the att&ck
classification for https://github.com/mandiant/capa-rules/blob/64b174e50253cbd506df40e7728531b801636a56/host-interaction/bootloader/get-uefi-variable.yml#L11 and https://github.com/mandiant/capa-rules/blob/64b174e50253cbd506df40e7728531b801636a56/host-interaction/bootloader/set-uefi-variable.yml#L11.
Without additional indicators, I'm not sure that we can draw the conclusion that getting/setting UEFI variables results in boot persistence.